PUBLIC OFFER (MASTER LICENSE AGREEMENT) NEXAXT WECO

Version: 1.0 Effective date: 11 May 2026 Prior versions: none (initial edition) Canonical URL: https://weco.nexaxt.com/pages/oferta-en.html SHA-256 of canonical text: computed at release publication and stored in the click-wrap log.

PREAMBLE

This document is a public offer (the "Offer") within the meaning of Article 395 of the Civil Code of the Republic of Kazakhstan ("RK Civil Code") made by NEXA IKS TI Limited Liability Partnership (BIN 230940021527), 050013, Republic of Kazakhstan, Almaty, Bostandyk district, Seifullin Avenue, building 617 (the "Licensor", "We", "NexaXT", "WECO"), addressed to any legal entity or natural person (the "Client", "Licensee", "You") who accepts it in the manner described in Section 3.

Full and unconditional acceptance of this Offer in the manner provided by Article 396 of the RK Civil Code constitutes a binding agreement (the "Agreement") between the Licensor and the Client governing the grant of a non-exclusive right to use the WECO software product — a self-hosted website constructor for special-purpose vehicles / structured-finance entities (SPV/SFO) — and related services (the "Service", "Software", "Product").

1. DEFINITIONS AND INTERPRETATION

1.1. "Licensor" — NEXA IKS TI LLP (ТОО «НЕКСА ИКС ТИ»), BIN 230940021527, a legal entity organized under the laws of the Republic of Kazakhstan.

1.2. "Client" — any person who accepts this Offer per Section 3.

1.3. "Parties" — the Licensor and the Client jointly; "Party" — either individually.

1.4. "Software" — the WECO product, comprising: (a) the Admin Control Plane (Next.js 16 + Prisma + NextAuth, deployed to one Ubuntu VM under the Client's control), (b) the Host VM Runtime (host-api + renderer + nginx + pdf-viewer + ff-certbot, deployed one VM per SPV site), (c) accompanying documentation, install scripts (install-admin.sh, vms/bootstrap.sh), and any updates and patches issued by the Licensor.

1.5. "License JWT" — a JSON Web Token signed with the Licensor's Ed25519 private key, carrying claims tier, max_hosts, max_admin_users, features, exp, licensee_email, license_id. Delivered to the Client's billing email after payment or upon trial issuance.

1.6. "Tier" — one of: Trial, Starter, Standard, Premium, Enterprise. Limits and pricing per https://weco.nexaxt.com/buy.html and/or the Order Form.

1.7. "Order Form" — a separate document (order, invoice, written confirmation) recording the Tier, license term, fees and other commercial conditions. Where an Order Form conflicts with this Offer, the Order Form prevails, except for Offer provisions expressly non-derogable.

1.8. "Agreement Documents" — this Offer, the EULA, the Terms of Service, the Privacy Policy, the DPA (where applicable), the SLA, the Refund Policy, the AUP, the Cookie Policy, the Subprocessors List, the Security Statement, and the Order Form. Together they form a single, indivisible Agreement.

1.9. "End User" — a visitor of the public SPV sites the Client publishes via the Software.

1.10. "Client Content" — all materials the Client or its authorized users publish, upload, process via the Software, including investor disclosures, PDFs, text, images, metadata.

1.11. "Canonical Text" — the text of an Agreement Document as published at https://weco.nexaxt.com/pages/, with the SHA-256 hash captured at the time of acceptance.

1.12. Headings are for convenience only. Singular includes plural and vice versa unless context dictates otherwise.

2. SUBJECT MATTER

2.1. Subject to the Agreement Documents, the Licensor grants the Client a non-exclusive, non-transferable, time-limited and scope-limited right to use the Software (the "License") on infrastructure under the Client's exclusive control, strictly within the limits encoded in the License JWT issued to the Client.

2.2. The License is not a sale of a copy of the Software, does not transfer exclusive rights in the Software or its components, does not permit sublicensing, and does not permit assignment to third parties without the Licensor's written consent.

2.3. The detailed scope of the Client's rights is set out in the EULA (https://weco.nexaxt.com/pages/eula-en.html).

2.4. The Licensor may offer related services: SLA-tiered technical support, training, custom development, data migration. These are scoped by separate Order Form.

3. ACCEPTANCE. SIMPLE ELECTRONIC SIGNATURE

3.1. Modes of acceptance. Any of the following constitutes full and unconditional acceptance of this Offer within the meaning of Article 396 of the RK Civil Code:

(a) clicking "Buy", "Pay", "Subscribe" or equivalent on https://weco.nexaxt.com/buy.html; (b) actual payment of License Fees by any available means; (c) activation or request of a trial license; (d) running the install-admin.sh installer with an issued License JWT; (e) any other use of the Software with a License JWT.

3.2. Electronic signature. The Parties agree that acceptance under §3.1, and any other acts of the Client performed by entering data, clicking buttons and confirming check-boxes, constitute a simple electronic signature within the meaning of paragraph 8) of Article 1 and Article 7 of the Law of the Republic of Kazakhstan "On Electronic Document and Electronic Digital Signature" of 7 January 2003 No. 370-II. The Parties mutually recognize the legal force of such a signature and treat documents so signed as equivalent to paper originals signed by hand.

3.3. Click-wrap log. At the moment of acceptance the Licensor records and retains for at least 7 (seven) years: (a) the Client's email; (b) license_id; (c) the SHA-256 hash of the Canonical Text of each Agreement Document in force at acceptance; (d) the UTC timestamp of acceptance; (e) the Client's IP address; (f) the User-Agent. This record is evidence of the Agreement.

3.4. Capacity. By accepting, the Client warrants that: (a) it has full legal capacity; (b) the individual accepting on its behalf is duly authorized; (c) the individual is at least 18 years old (the Service is not offered to minors); (d) for legal entities — the representative has authority by virtue of charter, power of attorney or other ground.

3.5. No acceptance, no rights. Any use of the Software without acceptance of this Offer is unauthorized and infringes the Licensor's exclusive rights.

4. FEES AND PAYMENT

4.1. Fees are set by the Tier published at https://weco.nexaxt.com/buy.html or by the Order Form.

4.2. All amounts are stated exclusive of applicable taxes; the Client pays them in addition where required by applicable law.

4.3. Payment is via the integrated payment provider (FreedomPay, Republic of Kazakhstan) or by bank transfer per invoice.

4.4. The License is activated and the License JWT issued within 24 hours of receipt of funds or payment-provider confirmation.

4.5. The Licensor may change prices and Tiers. New prices apply to new purchases and renewals; already-paid licenses are not repriced before the end of the paid term.

4.6. Refund and termination conditions are set out in the Refund Policy (https://weco.nexaxt.com/pages/refund-policy-en.html).

5. TERM AND RENEWAL

5.1. The Agreement enters into force upon acceptance (Section 3) and runs for the term encoded in the License JWT (exp), unless the Order Form provides otherwise.

5.2. The License does not auto-renew unless the Order Form provides otherwise. The Client may purchase renewal at any time.

5.3. Upon expiry: (a) previously published SPV sites continue operating on the Client's infrastructure — the Licensor has no technical means to disable them; (b) the Admin UI blocks new site creation, new admin user creation and credential rotation; (c) for 30 (thirty) days the Software remains available for regulatory-correction operations — editing existing-site content, replacing a defective PDF, removing inaccurate disclosure; (d) after 30 days, admin mutations are fully blocked.

6. LICENSOR OBLIGATIONS AND WARRANTIES

6.1. The Licensor undertakes to: (a) deliver a License JWT matching the paid Tier; (b) maintain availability of installer artifacts at https://weco.nexaxt.com and/or GitHub Releases; (c) disclose discovered critical and high-severity vulnerabilities via GitHub Security Advisory in the dist repository; (d) issue patches for critical/high vulnerabilities (CVSS ≥ 7.0) within 14 (fourteen) calendar days after confirmation; (e) maintain minisign signatures and SHA-256 checksums on every release artifact; (f) deliver technical support per the SLA (https://weco.nexaxt.com/pages/sla-en.html) applicable to the chosen Tier.

6.2. DISCLAIMER OF OTHER WARRANTIES. Save for the warranties expressly given in §6.1 and any non-derogable mandatory consumer-protection rights under RK Law No. 274-IV of 4 May 2010 "On Consumer Protection" (for natural-person consumers only), the Software and the Service are provided "AS IS" and "AS AVAILABLE", without any other warranty, express or implied, including but not limited to: (a) fitness for a particular purpose; (b) merchantability; (c) non-infringement of third-party rights; (d) uninterrupted or error-free operation; (e) suitability for the Client's specific jurisdiction or industry regulatory environment (including, without limitation, securities-issuer disclosure requirements, AML/CFT obligations, SPV/SFO accounting and reporting rules); (f) compatibility with the Client's infrastructure, antivirus / EDR / corporate proxies.

6.3. Boundary statements — what the Licensor does NOT cover: (a) volumetric DDoS — the Client must place a WAF / CDN before the admin VM; (b) full-disk encryption — the Client's responsibility on VM provisioning (LUKS / dm-crypt / BitLocker); (c) RTO / RPO for Client installations — the single-VM Phase 1 architecture cannot guarantee these; backup target and restore are on the Client; (d) compliance with the Client's local law in respect of disclosure, data protection, taxes, securities, financial reporting — solely the Client's responsibility; (e) ISO 27001 / SOC 2 / PCI-DSS certifications — the Licensor does not hold these and does not claim them at this phase.

7. CLIENT OBLIGATIONS AND WARRANTIES

7.1. The Client undertakes to: (a) use the Software strictly in accordance with the Agreement Documents; (b) not exceed the limits encoded in the License JWT (max_hosts, max_admin_users); (c) maintain the security of the infrastructure on which the Software is deployed (physical, network, OS layer); (d) keep MASTER_SECRET separately from DB backups and preserve its confidentiality; (e) discharge all legal, regulatory, tax obligations arising from publishing Client Content and from operating the SPV sites toward End Users; (f) timely pay fees and applicable taxes; (g) not transfer License JWT, admin credentials, SSH keys, access tokens to third parties.

7.2. The Client warrants and represents that: (a) it owns all rights to the Client Content it publishes via the Software; (b) the Client Content infringes no third-party rights (IP, data, image, copyright, neighbouring rights); (c) the Client Content does not violate applicable law; (d) neither the Client nor its beneficial owners nor its officers are on UN, OFAC (US), EU, UK, RK or other applicable sanctions lists, and the Client does not act for the benefit of such persons; (e) the Client does not use the Software for money-laundering, terrorism financing, fraud or other unlawful activity.

7.3. The full list of permitted and prohibited uses is in the Acceptable Use Policy (https://weco.nexaxt.com/pages/aup-en.html).

8. DATA OWNERSHIP. ROLES IN PERSONAL-DATA PROCESSING

8.1. Client Content and End-User data are stored and processed exclusively on the Client's infrastructure. The Licensor neither has access to such data, nor receives copies of it, nor relays it to third parties.

8.2. With respect to Client Content and End-User data, the Client is the sole operator / controller of personal data within the meaning of RK Law No. 94-V of 21 May 2013 "On Personal Data and Their Protection" ("94-V") and the corresponding rules of other applicable jurisdictions (GDPR, UK GDPR, etc.). The Licensor is neither operator nor processor in relation to such data.

8.3. With respect to data the Client transmits directly to the Licensor (contact details, billing data, support tickets that may contain personal data), the Privacy Policy (https://weco.nexaxt.com/pages/privacy-policy-en.html) and, where applicable, a separate DPA (https://weco.nexaxt.com/pages/dpa-en.html) apply.

9. CONFIDENTIALITY

9.1. "Confidential Information" — any non-public commercial, technical, financial, legal or other information one Party discloses to the other in connection with the Agreement, marked confidential or reasonably identifiable as such.

9.2. The receiving Party shall: (a) use Confidential Information solely for performing the Agreement; (b) protect it with no less than the standard of care it applies to its own confidential information, and at least with reasonable care; (c) not disclose it to third parties without the disclosing Party's written consent, except: (i) to employees, contractors and auditors bound by equivalent obligations; (ii) under a binding order of a state authority or court (with written notice to the disclosing Party where lawful).

9.3. The confidentiality obligation runs for the term of the Agreement and 5 (five) years after termination.

9.4. The obligation does not apply to information that: (a) was publicly available not through fault of the receiving Party; (b) was lawfully known to the receiving Party before disclosure; (c) was independently developed by the receiving Party without use of the Confidential Information; (d) was lawfully received from a third party not bound by confidentiality.

10. INTELLECTUAL PROPERTY

10.1. All exclusive rights in the Software (source code, binary builds, documentation, design, "WECO" / "NexaXT" trademarks, logos) belong to the Licensor or its licensors. The Agreement transfers no IP rights to the Client beyond the License expressly granted.

10.2. The WECO source code is additionally governed by FSL 1.1 / Apache 2.0 future (FSL-1.1-Apache-2.0). This Agreement does not override or modify FSL terms with respect to source code.

10.3. All rights in Client Content remain with the Client. The Client grants the Licensor a limited, royalty-free, non-exclusive licence to use the Client Content only to the extent technically necessary to provide the Service (e.g., page rendering, PDF processing). This licence terminates with the Agreement.

10.4. Anti-reverse-engineering. Save where mandatorily permitted by the RK Civil Code and FSL 1.1, the Client shall not decompile, disassemble, or attempt to extract source code from binaries, nor disable or circumvent the License JWT verifier, the bcrypt admin-password gate, AES-256-GCM encryption, or any other protective mechanism.

10.5. No reverse indemnity. The Licensor does not provide IP indemnity to the Client against third-party claims of IP infringement, regulatory non-fitness or otherwise. The open-source nature of the Software means the Client bears the related risk.

11. CLIENT INDEMNITY OF LICENSOR

11.1. The Client shall indemnify, defend and hold harmless the Licensor, its affiliates, directors, employees and representatives from and against any claim, suit, demand, cost, damage and legal expense (including reasonable defence costs) arising out of or in connection with:

(a) the Client's use of the Software in breach of the Agreement Documents or applicable law; (b) Client Content published via the Software, including third-party-rights claims, false-disclosure claims, consumer- or investor-protection claims; (c) the Client's regulatory non-compliance (securities laws, AML/CFT, data protection, taxes); (d) the Client's processing of End-User personal data; (e) breach by the Client of the warranties in Section 7; (f) disputes between the Client and its End Users; (g) inclusion of the Client or related persons on a sanctions list.

11.2. The Licensor shall give the Client reasonable notice of the claim and reasonable cooperation in defence. The Client may solely control defence and settlement, provided that any settlement imposing on the Licensor obligations beyond payment of money requires the Licensor's written consent.

12. LIMITATION OF LIABILITY

12.1. Aggregate cap. To the maximum extent permitted by applicable law, the aggregate liability of the Licensor to the Client on all grounds arising out of or in connection with the Agreement (in contract, tort, indemnity, otherwise) for the entire term of the Agreement is capped at the lower of:

(a) the total License Fees actually paid by the Client to the Licensor in the 6 (six) calendar months immediately preceding the event giving rise to the claim; OR

(b) USD 1,000 (one thousand US dollars) at the National Bank of Kazakhstan official rate as of the event date.

12.2. Trial = zero. For Clients on a Trial Tier the aggregate liability of the Licensor is zero.

12.3. Excluded damages. In no event shall the Licensor be liable for: (a) indirect, incidental, special, punitive or exemplary damages; (b) lost profits; (c) lost data; (d) loss of goodwill; (e) business interruption; (f) damages arising from the Client's regulatory non-compliance; (g) damages caused by acts or omissions of End Users.

12.4. The limits in this Section apply regardless of whether the Licensor was advised of the possibility of such damages and regardless of any failure of essential purpose of any limited remedy.

12.5. Carve-outs. The limits do not apply to: (a) the Client's indemnity obligations (Section 11); (b) wilful misconduct or gross negligence of the Licensor proven in established procedure; (c) the Client's infringement of the Licensor's exclusive rights in the Software; (d) the Client's payment obligations; (e) mandatory rules that may not be excluded by agreement.

13. FORCE MAJEURE

13.1. Neither Party shall be liable for failure or delay in performing obligations (other than already-due payments) caused by force majeure, including but not limited to: (a) natural disasters (earthquake, flood, fire, epidemic, pandemic); (b) war, mobilization, terrorism, civil unrest, revolution; (c) acts of state authorities — sanctions, embargoes, currency restrictions, export controls, changes of law; (d) cyber-attacks (including DDoS, ransomware, attacks on upstream providers); (e) large-scale internet outages, power failures, DNS failure, Certificate Authority failure; (f) failure of key suppliers and sub-processors; (g) strikes, lockouts; (h) any other event beyond the affected Party's reasonable control.

13.2. The affected Party shall notify the other within reasonable time (at most 10 business days) after the force-majeure event begins. The performance term extends by the period of force majeure.

13.3. If force majeure persists for more than 60 (sixty) calendar days, either Party may terminate the Agreement on written notice without liability for the termination itself.

14. GOVERNING LAW. PRE-TRIAL CLAIM. JURISDICTION

14.1. Governing law. The Agreement is governed by and construed under the laws of the Republic of Kazakhstan, without reference to conflict-of-laws rules pointing elsewhere. The 1980 UN Convention on Contracts for the International Sale of Goods (CISG) is expressly excluded.

14.2. Mandatory pre-trial claim. Before bringing suit, the aggrieved Party shall send the other a written claim setting out the alleged breach and remedy sought. The recipient shall reply in writing within 30 (thirty) calendar days. Only after that period without response, or after a negative response, may the claimant proceed to court.

14.3. Exclusive jurisdiction. Disputes not resolved pre-trial are submitted exclusively to the Specialized Inter-District Economic Court of Almaty, Republic of Kazakhstan. The Parties expressly waive any other jurisdiction or forum.

14.4. No class / no consolidation. All disputes are resolved individually only. The Client waives participation in class actions, group, consolidated or representative proceedings against the Licensor. Joinder of multiple Clients' claims is not permitted.

14.5. B2C consumer carve-out. Where the Client is a natural-person consumer domiciled in a state that grants such consumer rights non-derogable by agreement (e.g., EU member states, the United Kingdom), those non-derogable rights are preserved. This carve-out does not extend to legal entities or sole entrepreneurs.

14.6. No arbitration. The Parties expressly agree that disputes are not referred to arbitration, including AIFC Court, ICC, SIAC, LCIA or AAA. The jurisdiction of RK state courts is exclusive.

15. SANCTIONS AND EXPORT CONTROL

15.1. The Client warrants and represents that: (a) neither it, nor its beneficial owners, nor its officers, nor anyone acting on its behalf is on UN, OFAC, EU, UK, RK or any other applicable sanctions list; (b) it does not use the Software to resell or grant access to sanctioned persons / entities / countries; (c) it does not use the Software in DPRK, Iran, Syria, Cuba, or in occupied territories listed under UN/OFAC/EU/UK sanctions, and does not grant access from there.

15.2. On information that the Client or related persons are listed, the Licensor may immediately suspend or terminate the Agreement without liability and without obligation to refund.

16. AML / CFT

16.1. The Parties act in accordance with RK Law No. 191-IV of 28 August 2009 "On Counteraction to Legalization (Laundering) of Proceeds of Crime and Financing of Terrorism".

16.2. The Licensor may run KYC checks on the Client and its beneficial owners in case of suspicious operations, large payments, indicia of fictitiousness, or refusal to provide requested documents.

16.3. The Licensor may suspend or terminate the Agreement on any AML red flag, without prior notice and without obligation to refund.

17. ANTI-CORRUPTION

17.1. Each Party affirms compliance with RK Law No. 410-V of 18 November 2015 "On Counteraction to Corruption" and applicable foreign anti-bribery rules (FCPA, UK Bribery Act).

17.2. The Parties mutually undertake not to offer, give or accept improper advantages (financial or otherwise) in connection with the Agreement. Breach is grounds for immediate termination.

18. TERMINATION

18.1. Termination by Licensor for convenience. The Licensor may terminate on 30 (thirty) calendar days' notice without cause. In that case it refunds the Client's unused, prepaid fees pro rata.

18.2. Termination for breach. Either Party may terminate immediately on: (a) material breach by the other not cured within 14 days of written notice (for curable breaches); (b) for incurable breaches — without grace; (c) the Client's payment default exceeding 30 days; (d) insolvency / bankruptcy / liquidation of the other Party; (e) breach of sanctions warranties (Section 15); (f) AML red flag (Section 16); (g) AUP breach materially endangering the Service or third parties.

18.3. Effects of termination. (a) the License terminates; the Client must stop installing new instances of the Software; (b) existing installations run until the License JWT expires, subject to §5.3; (c) the Client may export Client Content and audit logs via the export mechanisms provided by the Software; (d) pro-rata refund of unused fees only on Licensor termination under §18.1; (e) on termination for Client breach — no refund.

18.4. Survival. Surviving sections: 1 (Definitions), 7.2 (Client Warranties), 8 (Data Ownership), 9 (Confidentiality — 5 years), 10 (IP), 11 (Client Indemnity), 12 (Liability Cap), 14 (Governing Law / Forum), 15 (Sanctions), 18.4 (this clause), 19, 21, 22.

19. AMENDMENT

19.1. The Licensor may unilaterally amend this Offer and any Agreement Document by publishing a new version at https://weco.nexaxt.com/pages/.

19.2. Non-material amendments (editorial, technical) take effect upon publication.

19.3. Material adverse amendments (price increase, feature reduction, expansion of Client obligations, increase of Client liability cap) take effect 30 (thirty) calendar days after notice to the Client's billing email and publication.

19.4. The Client's sole remedy for a material adverse amendment is termination within those 30 days with pro-rata refund of unused prepaid fees. Continued use after the 30 days is unconditional acceptance of the new version.

20. NOTICES

20.1. All notices under the Agreement are sent: (a) by the Licensor to the Client — to the email the Client provided at registration / payment (billing email); (b) by the Client to the Licensor — to anton.orlov@nexaxt.com (legal notices, claims) and info@nexaxt.com (general commercial).

20.2. A notice is deemed delivered 24 hours after sending, unless it bounces.

20.3. Change of contact details requires written notice to the other Party.

21. ASSIGNMENT

21.1. The Client may not assign rights or obligations under the Agreement without the Licensor's written consent.

21.2. The Licensor may assign rights and obligations to any successor (including in reorganization, sale of business, merger) without the Client's consent, on reasonable notice.

22. GENERAL

22.1. Entire Agreement. The Agreement Documents constitute the complete and exclusive agreement of the Parties on the subject matter and supersede all prior negotiations, correspondence, representations and agreements.

22.2. Severability. If any provision is invalid or unenforceable, the rest stays in force; the invalid provision is replaced with the closest valid one in meaning.

22.3. No waiver. Failure or delay in exercising any right is not a waiver.

22.4. Independent contractors. The Parties are independent contractors; no partnership, agency, joint venture or employment is created.

22.5. No third-party beneficiaries.

22.6. Headings — convenience only.

22.7. Languages. This Offer is drawn up in Russian. The English version is provided for convenience; in case of discrepancy the Russian version prevails.

22.8. Electronic form. The Parties agree to communicate, contract and exchange documents electronically. Documents signed by simple electronic signature (§3.2) have the same force as paper.

23. LICENSOR DETAILS

Full name: NEXA IKS TI Limited Liability Partnership Short name: NEXA IKS TI LLP Russian name: ТОО «НЕКСА ИКС ТИ» BIN: 230940021527 Registered & physical address: 050013, Republic of Kazakhstan, Almaty, Bostandyk district, Seifullin Avenue, building 617 Email (general): info@nexaxt.com Email (legal / DPO): anton.orlov@nexaxt.com Web: https://weco.nexaxt.com

End of Offer v1.0 of 11 May 2026.